Table datasets and the Splunk Datasets Add-on

You can create and manage table datasets if you use Splunk Enterprise and have installed the Splunk Datasets Add-on, or if you use Splunk Cloud.

Table datasets, or tables, are a type of dataset that you can create, shape, and curate for a specific purpose. You begin by defining the initial data for the table, such as an index, source type, search string, or existing dataset. Then you edit and refine that table in the Table Editor until it fits the precise shape that you and your users require for later analysis and reporting work.

After you create your table, you can continue to iterate on it over time, or you can share it with others so they can refine it further. You can also use techniques like dataset cloning and dataset extension to create new datasets that are based on datasets you have already created.

You can manage table datasets alongside other dataset types that are available to all users of Splunk Enterprise and Splunk Cloud, like data model datasets and lookups. All of these dataset types appear in the Datasets listing page.

The Splunk Datasets Add-on is preinstalled for all users of Splunk Cloud.

Default datasets functionality for Splunk Enterprise users

This table explains what all Splunk Enterprise and Splunk Cloud users can do with datasets by default.

Dataset activity

Why this is useful

View dataset contents

Check a dataset to determine whether it contains fields and values that you want to work with. For example, you can view lookup table files directly instead of searching their contents in the Search view.

Open datasets in Pivot

With Pivot you can design a visualization-rich analytical report or dashboard panel that is based on your dataset. Pivot can also help you discover data trends and field correlations within a dataset.

Additional dataset features provided by the Splunk Datasets Add-on

Splunk Enterprise users who install the Splunk Datasets Add-on gain the following datasets functionality. Cloud users get this functionality by default.

Dataset activity

Why this is useful

Use the Table Editor to create tables

You can design sophisticated and tightly-focused collections of event data that fit specific business needs, even if you have minimal SPL skills.

Share and refine tables over time

After you create a table you can give other users read or write access to it so they can curate and refine it. For example, you can create a simple dataset, and then pass it to another user with deep knowledge of the source data to shape it for a specific use. You can also extend your dataset and let other people refine the extension without affecting the original dataset.

View field analytics

The Table Editor offers a Summarize Fields view that provides analytical information about the fields in your dataset. You can use this knowledge to determine what changes you need to make to the dataset to focus it to your needs.

Extend any dataset as a table

Dataset extension enables you to create tables that use the definition of any dataset type as their foundation. This enables you to create tables that are based on lookups and data model datasets and then modify those tables to fit your specific use cases.

Clone tables

You can make exact copies of table datasets and save the copy with a new name. Only table datasets can be cloned.

Accelerate tables

You can accelerate table datasets in a manner similar to report and data model acceleration. This can be helpful if you are using a very large dataset as the basis for a pivot report or dashboard panel. Once accelerated, the table returns results faster than it would otherwise.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »